Skip to content

Rainier CLI v0.0.3 beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@jiashuoz jiashuoz released this 05 Sep 11:44
· 4 commits to main since this release
v0.0.3
ee2f467
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rainier CLI v0.0.3 beta

Prebuilt CLI downloads are now available for macOS and Linux. These binaries are built from the unchanged v0.0.3 tag (commit ee2f4671c400f307efa82bdefe5f179a3335f167).

Downloads

Platform Download
macOS Apple Silicon darwin/arm64
macOS Intel darwin/amd64
Linux x86-64 linux/amd64
Linux ARM64 linux/arm64

Installation and first session · SHA-256 checksums · Build information

Extract the matching archive, place rainier on your PATH, and run rainier --help. Verify its archive hash against SHA256SUMS before installing. macOS builds are not Developer ID signed or notarized.

Beta scope

  • An existing compatible Rainier server is required. The CLI does not provision a server or cloud workspace.
  • Start with self-hosted Rainier. Hosted Cloud agent-credential integration is still in development.
  • Agent login requires v0.0.3 server/runner components and an environment with the agent CLI installed.
  • Detach leaves the agent running; cold suspend stops its process. Workspaces and snapshots currently depend on runner storage. Push important work regularly; deleting a session deletes its workspace.
  • These exact-tag builds have no automatic updater or version subcommand. The archive name, checksum, and BUILDINFO identify the release.

v0.0.3 — the agent credential home

A coding agent inside a Rainier session — Claude Code, Codex — is logged in once and stays logged in: in every later session, in every workspace the person is a member of, on any runner.

What is new

  • The agent home. Every create for a person mounts one writable volume per (creator, workspace) at /rainier/agents, prepared once with the same CAP_CHOWN-only job the workspace volume gets and never torn down with a session. Each agent is pointed at its own subdirectory through the variable it already honors (CLAUDE_CONFIG_DIR, CODEX_HOME); $HOME and the read-only rootfs are untouched, and docker commit excludes the volume, so no environment snapshot can carry a credential.
  • The sync. sessiond fetches the provider's allowlisted credential files at boot, puts them within two seconds of every change (a background token refresh included), and empties them on a downward revoke. Three additive session-RPC methods carry it: fetch_agent_credentials, put_agent_credentials, revoke_agent_credentials. Reads use O_NOFOLLOW, the set is capped at 64 KiB, and the bytes are never kept — a digest is compared, not the credential.
  • Custody. One sealed set per (user, provider) in controld's database, AES-GCM under RAINIER_SECRETS_KEY with the user, provider, and version bound as additional authenticated data, the version assigned under a compare-and-set. A hosted control plane answers the same three methods through runnerplane.Host.SessionRequest with its own store.
  • The CLI and the wire. rainier agent login <provider> --env NAME, rainier agent ls, rainier agent logout <provider>, and GET|DELETE /v0/agents. Login is an ordinary session running the vendor's own login flow, attached to your terminal.
  • One table. Everything provider-specific is a row in controlapp/agents.go — claude and codex today. A third agent is a row plus its probes.

Public surface (additive, protocol version 1)

  • protocol/runner: Spec.Home *HomeMount{Volume, Path}; the three method-name constants.
  • controlapp: AgentProvider, AgentProviders(), EnableTestAgentProvider, HomeMountPath, AgentHomeVolume, AgentsEnv, AgentCredentialStore, AgentCredentialService, AgentCredentialSet, AgentCredentialStatus, AgentRefusalSentence, the ErrAgent… sentinels; controlapp/repotest.RunAgentCredentialStore.
  • v0wire: AgentView, AgentsEnvelope, RenderAgents.
  • internal/controld (self-host): migration 0010_agent_credentials.

Fixed

  • The session proxy URL carries a placeholder password. The driver handed every session http://<session-id>:@host:3128, and Claude Code — both the native and the npm build — refuses a proxy URL whose password is empty, failing every model call with "Connection error" without dialing the proxy. egressd only ever read the username half, so the URL now carries a fixed, non-secret password and both builds answer through the audited path in seconds. (#50)

Upgrade notes

  • A runner older than this release mounts no home; a session that carries one then fails its boot stage with this runner does not mount agent homes; upgrade runnerd to v0.0.3. Upgrade runnerd and controld together, as always.
  • controld migrates to schema 10 on start (one new table, agent_credentials, cascading with its user).
  • Every session's egress allowlist gains the agents' own hosts at dispatch (api.anthropic.com, platform.claude.com, downloads.claude.ai, mcp-proxy.anthropic.com; auth.openai.com, chatgpt.com), the way a clone adds the git hosts.
  • Boot notes (a refused or timed-out fetch) are emitted by sessiond but not yet surfaced by controld; the agent starts and asks for a login, which is the truthful state.

Plan: docs/superpowers/plans/2026-09-04-agent-credential-home.md, with its execution record.

Assets 9
Loading